Friday, March 06, 2009

5th Amendment Bummer

Over a year ago, I did a post on the U.S. Magistrate Judge’s decision in the Boucher case.

As I explained in that post, Sebastien Boucher was crossing the border from Canada into the United States when a Customs inspector flagged his laptop for further inspection. The inspector saw files on the laptop that he believed contained child pornography.

The inspector and an Immigration and Customs Enforcement (ICE) agent looked at more files and then ran into a drive – the Z drive – they couldn’t access. At their request, Boucher opened the Z drive and the agent saw more of what he thought was child pornography. He arrested Boucher, seized the laptop and shut it down. He then got a warrant to search the laptop:

In the course of creating a mirror image of the contents of the laptop, however, the government discovered that it could not find or open the Z drive because it is protected by encryption algorithms from the computer software `Pretty Good Protection,’ which requires a password to obtain access. The government is not able to open the encrypted files without knowing the password. In order to gain access to the Z drive, the government is using an automated system which attempts to guess the password, a process that could take years.

In re Boucher, 2009 WL 424718 (U.S. District Court for the District of Vermont).

As I explained in my last post, the government (a U.S. Department of Justice prosecutor) got a grand jury to subpoena Boucher and order him to produce the password needed to access the Z drive on his laptop. Boucher took the 5th Amendment and refused to comply; he argued that requiring him to produce the password would in effect require him to give testimony that could incriminate him.

As I explained in my earlier post, his argument was based on an aspect of the 5th Amendment privilege against self-incrimination that lets you take the 5th Amendment as the basis for refusing to produce evidence – computer files, a gun, any kind of physical evidence – that can be used to convict you of a crime. As I also explained, the U.S. Magistrate who had to decide whether to enforce the grand jury subpoena agreed with Boucher; the Magistrate said he could claim the 5th Amendment privilege and refuse to give up the encryption key . . . which essentially meant that the evidence on the laptop was beyond the government’s reach.

I was sure the U.S. Department of Justice would appeal the ruling, and it did. Since a U.S. Magistrate issued the ruling, the first step in appealing it was to ask the U.S. District Judge who supervises the Magistrate to decide whether the Magistrate was correct.

As I said last time, I think the U.S. Magistrate got it exactly right. Basically, the government wanted to do the same thing it tried in the Webster Hubbell case: While Hubbell was in jail on other charges, the Department of Justice served him with a grand jury subpoena that ordered him to produce lots of documents to the grand jury. U.S. v. Hubbell, 530 U.S. 27 (2000). Hubbell took the 5th Amendment and refused to produce them, making the same argument Boucher made: that producing the evidence would incriminate him.

To get around Hubbell’s invoking the privilege, the U.S. Department of Justice gave him immunity, which stripped him of his 5th Amendment privilege with regard to what the subpoena ordered him to do, so he produced the documents. Since he produced the documents under a grant of immunity, the government could not use his act of producing them or the contents of the documents against him. But the Department of Justice went through the documents and used what they found in them to charge Hubbell with new crimes. Hubbell moved to dismiss the charges, arguing that the government violated his 5th Amendment privilege; he said the government basically tricked him into producing the documents on the understanding they would not be used against him. Since they were used against him, Hubbell argued that what the Justice Department did violated his 5th Amendment privilege, and the U.S. Supreme Court agreed. It upheld the U.S. District Court’s granting the motion to dismiss the charges, so Hubbell walked. U.S. v. Hubbell, supra.

Boucher relied on the same principle. And like Hubbell, he is (IMHO) entitled to take the 5th Amendment privilege against self-incrimination as the basis for refusing to give the government the password for the Z drive. As I pointed out in my earlier post, the government could give him immunity for the act of producing it, but that would mean they couldn’t use any of the files on the laptop . . . which would make it impossible to prosecute him for the child pornography – if any – found on it. So there'd be no point in proceeding, from the government's perspective.

I suspect the federal prosecutors knew Boucher’s argument was valid . . . which is why they modified the grand jury subpoena before they asked the U.S. District Court Judge to decide whether the U.S. Magistrate’s opinion should stand. Instead of ordering Boucher to produce the Department of Justice had the subpoena modified so that now

it does not . . . seek the password for the encrypted hard drive, but requires Boucher to produce the contents of his encrypted hard drive in an unencrypted format by opening the drive before the grand jury. In oral argument and post-argument submissions, the Government stated that it intends only to require Boucher to provide an unencrypted version of the drive to the grand jury.

In re Boucher (2009), supra. Why did they do this? Well, I still think it doesn’t work, but it gave the prosecution a new argument.

As I explained in my earlier post, the Supreme Court has held that you can take the 5th Amendment when your act of producing evidence tells the government something it doesn’t already know. If you’re telling the government something it doesn’t already know, you’re testifying; if you’re just giving the government something it already knows you have and knows about, you’re not testifying. You’re just handing over physical evidence. The Department of Justice modified the Boucher subpoena to try to bring it within that loophole: handing over physical evidence instead of testifying.

The U.S. District Court Judge bought the argument. The Supreme Court has held that an essential part of telling the government something it doesn’t know (testifying) is authenticating the evidence you hand over. So, say a grand jury subpoenas me and orders me to “produce the gun you used to kill John X.” If I show up and hand over a gun, I’m implicitly testifying that yes, I have the gun and this gun I’m giving you is in fact the gun I used to kill John X. If the subpoena tells me to produce “the Taurus 38 caliber revolver serial # 3810384 you used to kill John X,” then I’m not telling the government anything when I produce the gun. The existence of the gun and the fact I have it and used it to kill John X are a “foregone conclusion.”

Getting back to Boucher, the Justice Department argued that by ordering him to produce an unencrypted version of the Z drive on his laptop, it wasn’t requiring him to testify:

Boucher accessed the Z drive of his laptop at the ICE agent's request. The ICE agent viewed the contents of some of the Z drive's files, and ascertained that they may consist of images or videos of child pornography. The Government thus knows of the existence and location of the Z drive and its files. Again providing access to the unencrypted Z drive “adds little or nothing to the sum total of the Government's information” about the existence and location of files that may contain incriminating information.

Boucher's act of producing an unencrypted version of the Z drive likewise is not necessary to authenticate it. He has already admitted to possession of the computer, and provided the Government with access to the Z drive. The Government has submitted that it can link Boucher with the files on his computer without making use of his production of an unencrypted version of the Z drive, and that it will not use his act of production as evidence of authentication.

In re Boucher (2009), supra. So the U.S. District Court judge denied Boucher’s motion to quash the grand jury subpoena (make it go away) and ordered him “to provide an unencrypted version of the Z drive viewed by the ICE agent” to the grand jury. In re Boucher (2009), supra.

Where does that leave Boucher? He has two choices: comply with the subpoena and give the grand jury an unencrypted (and unaltered) copy of the Z drive; or appeal the U.S. District Judge’s opinion.

If he turns over the drive, he may be prosecuted for, and convicted of, possessing child pornography. If he appeals, he might win; I think he would have a good shot at winning because I don’t buy the government’s position that producing an unencrypted version of the drive isn’t testimony within the 5th Amendment privilege. The issue isn’t producing the password; the issue is producing the drive and the contents of the drive.

The problem for Boucher is that since the U.S. District Judge has held that he can’t invoke the 5th Amendment, he’ll be held in contempt if he does not provide the grand jury with unencrypted version of the Z drive by the date specified on the subpoena. That means he’ll be held in civil contempt. As I explain to my students, when you’re held in civil contempt for failure to comply with a grand jury subpoena, you sit in jail until you are either willing to comply or can persuade a Court of Appeals to hold that you can, in fact, invoke the 5th Amendment and refuse to comply with the subpoena. Getting a case to and through the Court of Appeals could take a year, or two, at least (it took over a year for the government to get the U.S. District Court Judge to review the Magistrate’s order).

Selfishly, I hope Boucher takes the issue to the Court of Appeals because I think the 5th Amendment should protect encrypted files and I’d like to see that issue resolved. But I don’t have to sit in jail for a long time to see that happen.

11 comments:

Glad I read this. I'm being charged with a crime I didn't commit (nothing to do with child porn either - gross) and have to appear in front of a Grand Jury later this week. It's good to know my rights because I cannot afford an attorney.

Boucher appealed Judge Sessions’s ruling to the Second Circuit Court of Appeals, but then moved for dismissal of his own appeal. Why do you think that was? Maybe by now, since almost three years have passed, he has already forgotten the password. I am assuming that the password is highly complicated with numbers, special characters, and the like, and is probably many characters long. I guess this simply because the government has not already been able to crack the encryption despite years of effort. So it is quite plausible to say, "I forgot." FYI - when this story first came out I immediately went and bought PGP Whole Disk Encryption software. What better PR could that company and its software ask for? The simple fact that the U.S. Government and all its CIA / NSA supercomputer can not beat a $150 piece of software speaks volumes.

Thanks for this detailed post, it was a very interesting read. I was drawn to your entry with regard to the recent popularized case in the UK, covered http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/, as I was looking for US precedent.

Reading your analysis, I lean towards disagreeing with your opinion that producing drive contents is protected. I would argue that the drive contents are only protected, given his past access of the drive for the ICE agent, if that original access should be protected under fifth amendment as covered by Miranda and "reasonable belief" of custody.

I do not know the specifics of the original encounter, but I would certainly argue that if he gave up his protection from self-incrimination while "in custody" and informed of his rights, then he must produce that evidence again during court testimony.

The issues I was dealing with in the two Boucher posts is the "pure" 5th Amendment issue, which arises when someone is subpoenaed by a grand jury or by some other judicial body and ordered to produce physical evidence (i.e., do something other than testify).

As the U.S. Supreme Court explained in several decisions, Miranda is a fabrication -- a set of prophylactic rules the Court created to address a specific evil -- physical and psychological coercion in police interrogations. In the Mandujano case, which I believe I cited in the original Boucher post, the Court held that Miranda does not apply outside the context of custodial police interrogations . . . so Miranda is not implicated in Boucher-style scenarios.

In Boucher-style scenarios, the person who has been ordered to produce evidence must rely on the 5th Amendment privilege. And one's ability to invoke the protections of the 5th Amendment depends on that person's ability to demonstrate compulsion (subpoena suffices), testimony and incrimination.

And yes, I saw the Register story on the recent UK case. This summer I did a post on the 2008 opinion from the UK Court of Criminal Appeals, which involved a similar scenario. If you're interested in a comparison of 5th Amendment analysis and the analysis under UK law, you might check out that post.

grl_lover: While I don't think even the NSA can break this kind of encryption, this case provides no evidence one way or the other. I assure you that if the NSA could break Boucher's encryption, they would never assist law enforcement by doing so.

It would only take one or two people running around saying "I used PGP whole disk encryption and the FBI got my data somehow" to make the people who are a real threat to national security switch to some other program.

The NSA would never risk compromising an intelligence source over something like Boucher.

What I find most bothersome about this issue is, from all that I have been able to ascertain (as an uninformed non-litigant), that no tangible proof has been made that the Z drive does in fact contain illegal content. While I understand that it has been stated by the ICE agent that he was shown images from the Z drive, has it been *proved* to legal sufficiency that there is, in fact, illegal content on the Z drive? If so, then I grudgingly would admit that Mr. Boucher's case is considerably weaker. But only if this fact can be proven prior to compelling the decryption of the Z drive. Additionally, there is the matter of whether there is *known* to be any illegal content at all; all recounts I have read state that there only "may be" illegal content... So, if my understanding is correct, wouldn't it be patently incriminating to produce the Z drive when there is not known to be specifically illegal content, nor that it can be proved that the Z drive contains content of any type?

I think Beauner13 makes a good point. As I noted in the posts I did on the Boucher case, whether or not he can claim the 5th Amendment privilege and refuse to produce the enrcryption key (which gives law enforcement access to the contents of the Z drive) depends on whether or not producing the key incriminates him . . . i.e., gives the government access to information it doesn't yet have and that implicates him in criminal activity.

The Supreme Court has said, in the Hoffman case, that when someone claims the 5th Amendment privilege, a court is to give them the benefit of the doubt if it is apparent, from the context in which the question is asked (i.e., for the key), that answering could be "dangerous." So I guess the issue that's going to have to be resolved here is how apparent that must be.